Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-12482Path Traversal via Symlink Name Validation Bypass in keras-team/kerasPyPI · keras · fixed in 3.12.3, 3.15.0
- CVE-2026-44745Open Redirect vulnerability in SAP Approuternpm · @sap/approuter · fixed in 21.2.0
- CVE-2026-27690HTTP Request Smuggling in SAP Approuternpm · @sap/approuter · fixed in 20.10.0
- CVE-2026-623289Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpointsnpm · 9router
- CVE-2026-623279Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/statsnpm · 9router
- CVE-2026-62197OpenClaw < 2026.6.6 Policy Bypass via CDP Discoverynpm · openclaw · fixed in 2026.6.6
- CVE-2026-62188OpenClaw < 2026.6.9 Feishu Authorization Bypassnpm · @openclaw/feishu · fixed in 2026.6.9
- CVE-2026-62187OpenClaw < 2026.6.9 Feishu tools Authorization Bypassnpm · @openclaw/feishu · fixed in 2026.6.9
- CVE-2026-598019Router 0.4.41 - Unauthenticated API Exposure via /api/providersnpm · 9router
- CVE-2026-58500MCP Appium: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)npm · appium-mcp · fixed in 1.85.10
- CVE-2026-62240CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape ToolsPyPI · crewai-tools · fixed in 1.15.1
- CVE-2026-55771CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilitiesMaven · com.cedarpolicy:cedar-java · fixed in 2.3.6, 3.4.1, 4.9.0
- CVE-2026-55773CedarJava has a policy injection vulnerabilityMaven · com.cedarpolicy:cedar-java · fixed in 2.3.6, 3.4.1, 4.9.0
- CVE-2026-55772CedarJava has a type confusion vulnerabilityMaven · com.cedarpolicy:cedar-java · fixed in 2.3.6, 3.4.1, 4.9.0
- GHSA-7XW9-549R-8JRCDIRAC: SQL injection and lack of access control in PilotManager servicePyPI · dirac · fixed in 8.0.79, 9.0.22, 9.1.10
- CVE-2026-49970Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePath()Packagist · plank/laravel-mediable · fixed in 7.0.0
- CVE-2026-41041Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.PyPI · apache-gravitino · fixed in 1.2.1
- CVE-2026-49876Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIsPyPI · apache-gravitino · fixed in 1.3.0
- CVE-2026-15529yzhao062 pyod persistence.py pyod.utils.persistence.load deserializationPyPI · pyod · fixed in 3.6.2
- CVE-2026-56271Flowise - Weak Default JWT Secrets in Authentication Middlewarenpm · flowise · fixed in 3.1.0
- CVE-2026-56260Crawl4AI - Arbitrary File Write via output_path ParameterPyPI · crawl4ai · fixed in 0.8.7
- CVE-2026-56259Crawl4AI - LLM Credential Exfiltration via base_url and Environment Variable ResolutionPyPI · crawl4ai · fixed in 0.8.8
- CVE-2026-61870ImageMagick before 7.1.2-26 Memory Leak via VIFF EncoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61861ImageMagick before 7.1.2-26 Use-After-Free in FormatMagickCaptionNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61858ImageMagick before 7.1.2-26 Policy Bypass via APNG encoderNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61857ImageMagick before 7.1.2-26 Heap Use-After-Free via XMPNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61465ImageMagick before 7.1.2-26 Memory Allocation Policy BypassNuGet · magick.net-q16-anycpu, magick.net-q16-arm64 +15 · fixed in 14.15.0
- CVE-2026-61448Parse Server 9.0.0 Stored XSS via malformed Content-Typenpm · parse-server · fixed in 9.10.0-alpha.2, 8.6.84
- CVE-2026-61447PraisonAI before 1.6.78 Remote Code Execution via CodeAgentPyPI · praisonaiagents · fixed in 1.6.78
- CVE-2026-61445PraisonAI before 4.6.78 Arbitrary File Write and Command ExecutionPyPI · praisonai · fixed in 4.6.78